CVE-2026-69348: Windows Win32k Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
Other sources
Windows Win32k Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33438Patch KB5122871 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9445Patch KB5124008 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9445Patch KB5124008 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.2954Patch KB5124012
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems running Microsoft Windows 11 or Microsoft Windows Server 2025 are identified as affected. Exploitation is local, so exposure depends on an attacker being able to run code or otherwise authenticate on the target system.
What access does an attacker need to exploit it?
The attacker must be authorized and have local access. No user interaction is required according to the supplied vector.
What is the likely impact of successful exploitation?
A successful heap-based buffer overflow in Win32k can allow local privilege elevation. The supplied severity vector indicates high impacts to confidentiality, integrity, and availability.